Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.
Close a case or alert with the required reason, root cause, and justification comment.
ARTIFACT_ID - The ID of the case or alert to closeARTIFACT_TYPE - Either "Case" or "Alert"CLOSURE_REASON - Must be one of:
MALICIOUS - Confirmed threatNOT_MALICIOUS - False positive or benignMAINTENANCE - System/maintenance activityINCONCLUSIVE - Unable to determineUNKNOWN - Unknown/otherROOT_CAUSE - Must match a predefined root cause (use get_case_settings_root_causes to list options)CLOSURE_COMMENT - Detailed justification for closureALERT_GROUP_IDENTIFIERS - Alert group identifiersASSIGN_TO_USER - User to assign closed alert toTAGS - Comma-separated tagsFor Cases:
secops-soar.siemplify_close_case(
case_id=ARTIFACT_ID,
reason=CLOSURE_REASON,
root_cause=ROOT_CAUSE,
comment=CLOSURE_COMMENT,
alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)
For Alerts:
secops-soar.siemplify_close_alert(
alert_id=ARTIFACT_ID,
reason=CLOSURE_REASON,
root_cause=ROOT_CAUSE,
comment=CLOSURE_COMMENT,
assign_to_user=ASSIGN_TO_USER,
tags=TAGS
)
| Output | Description |
|---|---|
CLOSURE_STATUS | Success/failure status of the closure |
| Scenario | Reason | Typical Root Cause |
|---|---|---|
| False Positive | NOT_MALICIOUS | "Legit action", "Normal behavior" |
| Duplicate | NOT_MALICIOUS | "Similar case is already under investigation" |
| Benign True Positive | NOT_MALICIOUS | "Legit action" |
| Confirmed Threat (remediated) | MALICIOUS | Varies by threat type |
| Unable to determine | INCONCLUSIVE | "Insufficient data" |
If unsure of valid root cause values:
secops-soar.get_case_settings_root_causes()